EIDCA-005: Unprotected Groups in CA Exclusions
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Conditional Access
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Groups used in Conditional Access exclusions that lack ownership, membership reviews, or access restrictions can be exploited by attackers to bypass security policies. An attacker who adds themselves to an unprotected exclusion group effectively bypasses all CA controls targeting that group.
Valor recomendado
All CA exclusion groups have assigned owners, restricted membership management, and regular access reviews enabled
Remediación
Identify all groups referenced in CA policy exclusions and verify each group has an assigned owner, restricted join/leave settings, and an active access review schedule. Enable Privileged Access Group features or restrict group membership changes to authorized administrators only. Remove any unmanaged or orphaned groups from CA exclusions immediately.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-6(5)
- MITRE ATT&CK
- T1078.004